How to secure generative AI at work: what Claude Enterprise adds

On November 5, 2026, Anthropic added a set of security controls to Claude Enterprise: a security center that audits your configuration, "inference hooks" that can block a message containing sensitive data before it reaches the model, and tools that stop people from using personal accounts on company computers. For a small or mid-sized business, the announcement matters beyond Claude. It maps out where the real risks of generative AI at work sit, and which protections you should demand from any tool before handing it to your teams.

What exactly did Anthropic announce?

According to Anthropic's official announcement, published on November 5, 2026, the update covers the Claude Enterprise plan and includes several pieces, most of them in beta:

• A security center (beta). A page in the organization settings compares your configuration for chat, Cowork (the agent that works on the user's files) and Claude Code against the configuration Anthropic recommends. For each control it shows the current value, the recommended value and a link to change it. You can download an audit report. Anthropic states that the security center is guidance based on its recommendations, not a certification or a guarantee of compliance.
• Inference hooks, now generally available to Enterprise customers. They send every message, and every action Claude is about to take in a connected tool, to a security server of the company's choosing, which allows or blocks it.
• Centralized management (beta) for groups running several Claude organizations: single sign-on, directory sync and shared admin roles.
• Shadow IT controls (beta). On company-managed computers, admins can block personal Claude accounts in the desktop app and limit which folders Claude can access.
• Remote sign-out of a member across all their devices, a self-managed IP allowlist, and support for running the company's endpoint detection and response (EDR) sensor inside the Cowork virtual machine.

None of this is spectacular on its own. Taken together, it answers the question every IT manager keeps asking: how do you let teams use AI without losing control of your data?

How do inference hooks work?

This is the most interesting piece, because it targets the main risk: an employee pasting a contract, a customer file or a payslip into a conversation.

According to Anthropic's technical documentation, it works like this. When a user sends a message, Anthropic forwards the conversation to a security server run by the company or its vendor. That server replies "allow" or "deny", within 5 seconds by default. A denied message never reaches the model, and the user sees a message explaining why. The check also covers text extracted from attachments and, if the option is on, the actions Claude wants to take in a connected tool (email, file storage, CRM).

The server is usually a data loss prevention (DLP) tool: software that spots sensitive information (card numbers, health data, documents marked confidential) and applies company policy. The Next Web lists compatible vendors such as Netskope, Palo Alto Networks and Zscaler. The feature first shipped in beta on August 5, 2026, as Check Point points out.

Three details in the documentation matter in practice:

• Failure behavior is your call. If the security server does not answer, the company decides in advance whether to block the message or let it through unchecked. The first option protects you, the second avoids freezing your teams. Make that choice deliberately.
• Rollout can be gradual. A shadow mode records what would have been blocked without blocking anything, and you can inspect only a share of messages at first.
• The limits are spelled out. Images are not inspected (a screenshot of a confidential document goes through), the server can only allow or deny, not mask part of the text, and the feature covers neither API access nor Claude used through Amazon Bedrock or Google Cloud.

Why has securing generative AI become urgent?

Because employees do not wait for permission. The global study run by the University of Melbourne with KPMG, covering more than 48,000 people in 47 countries and published in 2025, found that almost half of employees admit to using AI in ways that break company policy, including uploading sensitive company information into free public AI tools. In the same study, only 40% of employees said their workplace had a policy or guidance on generative AI, and 47% said they had received AI training.

That is what people call shadow AI: real and often useful usage that management cannot see, on personal accounts whose settings and data retention the company does not control.

Our take: banning AI fixes nothing, it just moves the problem to personal phones. The right answer is to provide a managed tool, good enough that nobody wants to work around it, with clear rules on what can go into it.

Can a small business actually use these protections?

Only partly, and it is worth being blunt about it. Inference hooks are limited to the Claude Enterprise plan, and only organization owners can configure them. Above all, they assume you have a security server to plug in, which means a DLP tool and someone to write its rules. That is the kit of a group with a security team, rarely that of a 50-person company.

The rest of the announcement is more useful for mid-sized organizations. Blocking personal accounts on company machines, cutting off a departing employee, restricting access to office IP addresses: these are simple measures that close the most common leaks.

Here is how we rank protections by company size and data sensitivity:

What do European regulators recommend?

France's data protection authority, the CNIL, has published questions and answers on using a generative AI system that point the same way. It recommends starting from a concrete need rather than deploying a tool with no clear purpose, drawing up a list of allowed and forbidden uses, and training users on both the forbidden uses and the risks of the allowed ones. It also advises involving your data protection officer (DPO) and, where relevant, carrying out an impact assessment.

On hosting, the CNIL considers that for sensitive or strategic data, an on-premise deployment, meaning servers the company controls, is generally more appropriate and more secure. We compared the hosting options in our decision matrix on trusted cloud versus on-premise.

In other words, Anthropic's technology does not replace governance. A DLP filter enforces a policy, it does not write one.

Should you use a general-purpose assistant or a custom agent?

Both have their place, and most companies need both.

A general-purpose assistant such as Claude, ChatGPT or Copilot, on a business plan, is great for drafting, summarizing, research and code. It needs to be properly configured, with the protections in the table above, but it should not become the place where all your company data ends up.

For use cases that touch critical data (patient records, contracts, HR data, confidential technical documents), we recommend a dedicated agent instead. It only accesses the documents it needs, respects each user's access rights, logs its answers and can run on a model hosted in Europe or on your own servers. That is the approach we describe on our page about GDPR and AI Act compliant AI and, for querying internal documents, on our RAG page.

As soon as an agent acts in your tools, another attack surface appears: malicious instructions hidden in a document or an email. We covered it in our analysis of AI agent security.

What this means for your business

Take stock of real usage. Before picking a tool, ask your teams, with no blame attached, which AI tools they use and for what. You will learn which data is already moving around and which needs you have to cover.

Provide a business tool and shut down personal accounts. A well-configured business subscription, with single sign-on and a one-page policy on allowed data, closes most leaks. Use configuration audits when the vendor offers them, like Claude's new security center.

Move critical data out of the general-purpose assistant. For sensitive records, build a dedicated agent with access rights and an audit trail, rather than hoping a filter catches every mistake.

Frequently asked questions

Are Claude Enterprise conversations used to train models?

The answer is in the vendor's contract and data processing terms, not in a sales brochure. Check the same documents for how long conversations are kept and where they are hosted. These are the first clauses to have your DPO review, whatever the tool.

Are inference hooks available on the Claude Team plan?

No. According to Anthropic's documentation, they are limited to Claude Enterprise organizations. The Team plan offers other admin controls, but not this message filtering.

Does a DLP filter make AI use GDPR compliant?

No. It reduces the risk of accidental leaks, but compliance also requires a legal basis, informing the people concerned, a defined retention period and, in some cases, an impact assessment. The filter enforces the rules, it does not replace them.

Can we simply ban generative AI for employees?

You can, but the University of Melbourne and KPMG study shows that the rules are widely ignored. A ban with no alternative pushes usage onto personal phones and accounts, where you have no visibility at all.